Instant Access ISACA.CISA.v2025-09-01.q454 Actual Practice Test Engine for Free (Page 88)

Question 431

During an integrated audit at a retail bank, an IS auditor is evaluating whether monthly service fees are appropriately charged for business accounts and waived for individual consumer accounts. Which of the following test approaches would utilize data analytics to facilitate the testing?

A.Attempt to charge a monthly service fee to an individual consumer account.
B.Compare the system configuration settings with the business requirements document.
C.Evaluate whether user acceptance testing plans were designed and executed appropriately.
D.Review customer accounts over the last year to determine whether appropriate charges were applied.

Question 432

Which of the following BEST describes the role of a document owner when implementing a data classification policy in an organization?

A.Classifies documents to correctly reflect the level of sensitivity of information they contain
B.Classifies documents in accordance with industry standards and best practices
C.Defines the conditions under which documents containing sensitive information may be transmitted
D.Ensures documents are handled in accordance with the sensitivity of information they contain

Question 433

An IS auditor is evaluating the security of an organization's data backup process, which includes the
transmission of daily incremental backups to a dedicated offsite server. Which of the following findings
poses the GREATEST risk to the organization?

A.Backup transmissions are not encrypted
B.Backup transmissions occasionally fail
C.Data recovery testing is conducted once per year
D.The archived data log is incomplete

Question 434

Which of the following functionality is NOT supported by SSL protocol?

A.Confidentiality
B.Integrity
C.Authentication
D.Availability

Correct Answer: D

Section: Protection of Information Assets
Explanation/Reference:
The NOT is a keyword used in this question. You need to find out the functionality which is NOT provided
by SSL protocol. The SSL protocol provides:
Confidentiality
Integrity
Authentication, e.g. between client and server
Non-repudiation
For CISA exam you should know the information below about Secure Socket Layer (SSL) and Transport
Layer Security (TLS)
These are cryptographic protocols which provide secure communication on Internet. There are only slight
difference between SSL 3.0 and TLS 1.0. For general concept both are called SSL.
SSL is session-connection layer protocol widely used on Internet for communication between browser and
web servers, where any amount of data is securely transmitted while a session is established. SSL
provides end point authentication and communication privacy over the Internet using cryptography. In
typical use, only the server is authenticated while client remains unauthenticated. Mutual authentication
requires PKI development to clients. The protocol allows application to communicate in a way designed to
prevent eavesdropping, tampering and message forging.
SSL involves a number of basic phases
Peer negotiation for algorithm support
Public-key, encryption based key exchange and certificate based authentication
Symmetric cipher based traffic encryption.
SSL runs on a layer beneath application protocol such as HTTP, SMTP and Network News Transport
Protocol (NNTP) and above the TCP transport protocol, which forms part of TCP/IP suite.
SSL uses a hybrid hashed, private and public key cryptographic processes to secure transmission over the
INTERNET through a PKI.
The SSL handshake protocol is based on the application layer but provides for the security of the
communication session too. It negotiates the security parameter for each communication section. Multiple
session can belong to one SSL session and the participating in one session can take part in multiple
simultaneous sessions.
The following were incorrect answers:
Confidentiality - It is supported by the SSL Protocol
Integrity -It is supported by the SSL Protocol
Authentication - It is supported by the SSL protocol
The following reference(s) were/was used to create this question:
CISA review manual 2014 Page number 352

Question 435

What should be the GREATEST concern to an IS auditor when employees use portable media (MP3 players, flash drives)?

A.The copying of sensitive data on them
B.The copying of songs and videos on them
C.The cost of these devices multiplied by all the employees could be high
D.They facilitate the spread of malicious code through the corporate network

Question 431

Question 432

Question 433

Question 434

Question 435

Download PDF File